Hardcoded Static AES Key Vulnerability in TTLock Android App by TTLock
CVE-2026-112345

8.6HIGH

Key Information:

Vendor

Sciener

Status
Ttlock
Vendor
CVE Published:
26 October 2026

What is CVE-2026-112345?

The TTLock Android application prior to version 9.8.260718, along with its associated smart-lock firmware, features a serious flaw due to a hardcoded static AES key. This vulnerability permits attackers within Bluetooth range to exploit the system by decrypting the per-pairing session key exchanged during Bluetooth Low Energy (BLE) pairing. By observing this pairing exchange, attackers can recover the persistent session key using the embedded default key, enabling them to forge authenticated BLE requests. Consequently, this allows unauthorized actions such as unlocking the device, altering access codes, or adding fingerprints without any user authentication or interaction.

Affected Version(s)

TTLock 0 < 9.8.260718

References

https://damiri.fr/en/cve/CVE-2026-112345
technical-descriptionexploit
https://www.vulncheck.com/advisories/ttlock-android-app-h...
third-party-advisory

CVSS V4

Score:
8.6
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
None
Attack Vector:
Adjacent Network
Attack Complexity:
Low
Attack Required:
None
Privileges Required:
Undefined
User Interaction:
None

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Credit

Yassine Damiir
.